# CVE-2026-0319: Palo Alto Networks PAN-OS GlobalProtect session hijacking

Source: https://junglewise.ai/threats/cve-2026-0319-an-improper-input-handling-vulnerability-in-the-globalprotect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-0319 · Severity: info · Published 2026-10-14

Palo Alto Networks PAN-OS is firewall software that protects corporate networks through VPN and network access control. An authenticated user can exploit improper input handling in the GlobalProtect gateway to hijack another user's VPN session, gaining access to network resources under a different identity without detection.

Technologies: [Palo Alto Networks PAN-OS](https://junglewise.ai/threats/technologies/pan-os), [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-0319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0319 being exploited in the wild.

**How severe is CVE-2026-0319?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** Palo Alto Networks PAN-OS 12.2.0–12.2.3; 12.1.0–12.1.10-h*; 11.2.0–11.2.15; 11.1.0–11.1.16-h*; 10.2.0–10.2.18-h*; Palo Alto Networks Prisma Access 12.1.0–12.1.7-h7; 11.2.0–11.2.7-h20; 10.2.0–10.2.10-h40; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.

**Is there a fix for CVE-2026-0319?** Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0319 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0319?** Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41

## Technical details

Improper input handling in the GlobalProtect gateway enables an authenticated attacker to establish a GlobalProtect session using the identity of a different user. The vulnerability requires network access and prior authentication but allows privilege escalation or lateral movement by impersonating other users. Cloud NGFW and Panorama are not affected.

## Affected products

- Palo Alto Networks PAN-OS 12.2.0–12.2.3; 12.1.0–12.1.10-h*; 11.2.0–11.2.15; 11.1.0–11.1.16-h*; 10.2.0–10.2.18-h*
- Palo Alto Networks Prisma Access 12.1.0–12.1.7-h7; 11.2.0–11.2.7-h20; 10.2.0–10.2.10-h40
- Siemens RUGGEDCOM APE1808 all versions with Palo Alto Networks Virtual NGFW

## Timeline

- 2026-10-14: disclosed

## References

- [https://security.paloaltonetworks.com/CVE-2026-0319](https://security.paloaltonetworks.com/CVE-2026-0319)
- [https://cert-portal.siemens.com/productcert/html/ssa-104023.html](https://cert-portal.siemens.com/productcert/html/ssa-104023.html)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS authentication bypass in GlobalProtect](https://junglewise.ai/threats/cve-2026-0328-authentication-bypass-vulnerabilities-in-the-globalprotect-portal)
- [Palo Alto Networks PAN-OS privilege escalation in GlobalProtect](https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS buffer overflow in protocol and service processing](https://junglewise.ai/threats/cve-2026-0326-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)